dridex | 2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a

Analysis

Target

2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe
Size

204KB
MD5

6a829dd94b99a731bcbb1d53c767755b
SHA1

cdb8af13104670df617def920efab8e1d21b66e5
SHA256

2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a
SHA512

e06da9bbe0a89bdd154013e0bce87405ee443846f58d448b41dd12cef3fa8993569cb559937236987144b3b8208a2bb7f5c8f0e4edf3d219c40e7986534bdb8c

Score

10^/10

dridex botnet

Family

dridex

5.196.15.119:443

46.105.131.72:443

157.7.163.144:3389

199.119.78.9:4143

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe

description pid process

Token: SeRestorePrivilege 4220 2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe

description	pid	process
Token: SeRestorePrivilege	4220	2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe

description	pid	process	target process
PID 4220 wrote to memory of 3460	4220	2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe	raserver.exe
PID 4220 wrote to memory of 3460	4220	2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe	raserver.exe
PID 4220 wrote to memory of 3460	4220	2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe	raserver.exe
PID 4220 wrote to memory of 3460	4220	2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe	raserver.exe

C:\Windows\SysWOW64\raserver.exe
C:\Windows\SysWOW64\raserver.exe "C:\Users\Admin\AppData\Local\Temp\2544af1a942338af41ec889c9e69bacb2e08218e1e575678d41b370024b36c6a.exe"
2⤵
PID:3460

memory/3460-133-0x0000000000000000-mapping.dmp

Download
memory/3460-135-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3460-137-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3460-134-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3460-136-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3460-139-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3460-138-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/3460-145-0x0000000001290000-0x0000000001296000-memory.dmp

Filesize
24KB

Download
memory/4220-130-0x0000000003000000-0x0000000003033000-memory.dmp

Filesize
204KB

Download
memory/4220-132-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download